Sanitizers

Sanitizing input is mandatory in WP Social Ninja. All of these helpers are defined in boot/globals.php and are available globally.

wpsr_backend_sanitizer()

The primary backend input sanitizer. It walks an input array against a sanitize map (dot-notation keys → sanitize method) and applies the right cleaner to each value. At the end it runs the result through the wpsocialreviews/backend_sanitized_values filter.

wpsr_backend_sanitizer(
    array &$inputs,           // input, sanitized in place
    array $sanitizeMap,       // key => method, dot-notation for nested keys
    string $defaultMethod = 'sanitize_text_field',
    string $keyPrefix = ''
);

Example:

$inputs = $request->all();

wpsr_backend_sanitizer($inputs, [
    'title'            => 'sanitize_text_field',
    'settings.color'   => 'wpsr_sanitize_color',
    'settings.width'   => 'wpsr_sanitize_css_unit',
    'recipients'       => 'wpsr_sanitize_recipients',
]);

// $inputs is now sanitized; anything not in the map uses the default method.

See the backend_sanitized_values filter to post-process the result.

wpsr_sanitize_* helpers

Use these for specific value types — especially style/CSS config, which sanitize_text_field would mangle.

Function	Sanitizes
wpsr_sanitize_boolean($value, $as_string = true)	Boolean-like input
wpsr_sanitize_opaque_token($value)	Opaque platform-connection tokens (base64 / base64url / UUID charset)
wpsr_sanitize_recipients($value, $as_string = true)	Comma list / array of emails
wpsr_sanitize_css_selector($selector)	A CSS selector (strips unsafe chars)
wpsr_sanitize_color($color)	Hex / rgb(a) / hsl(a) / named color
wpsr_sanitize_http_url($value) 4.4.0	An http(s) URL, host included — '' when unusable
wpsr_sanitize_css_unit($value)	Number + CSS unit (e.g. 12px, 1.5rem)
wpsr_sanitize_css_keyword($value)	CSS keyword (sanitize_key wrapper)
wpsr_sanitize_styles_config($styles_config)	A nested styles-config array
wpsr_sanitize_style_properties($properties)	Per-element style properties (recursive)
wpsr_sanitize_style_data($data)	A color / typography / spacing style block by key

Example — sanitizing a color and a unit:

$color = wpsr_sanitize_color($_POST['bg']);      // '' if invalid
$width = wpsr_sanitize_css_unit($_POST['width']); // '' if not a valid unit

wpsr_sanitize_color() range-checks channels since 4.4.0

The function previously matched rgb() / rgba() / hsl() / hsla() on shape only, so rgb(999,0,0) and rgba(0,0,0,1.5) passed through. It now also validates ranges and returns '' when a value is out of bounds:

• rgb / rgba channels: 0–255, or 0–100 when written as a percentage.
• hsl / hsla: hue 0–360, saturation and lightness 0–100.
• Alpha: 0–1.

Stored values that were previously accepted are unaffected — this only changes what new input is allowed to save. If you round-trip colors through this helper, an out-of-range value that used to survive now clears the setting instead.

wpsr_sanitize_http_url() and its boolean twin wpsr_is_http_url() are documented with the URL helpers on the Global Helpers page — they enforce one http(s) rule shared by the form, the REST validator, and every renderer.

Persisting options

When you save sanitized values as WordPress options, disable autoload:

update_option('wpsr_my_addon_settings', $sanitized, 'no');

Why dedicated CSS sanitizers?

Style configs contain values like #ff0088, 1.5rem, and selectors that WordPress's generic text sanitizers would break. The wpsr_sanitize_* helpers validate each value against its expected format and drop anything invalid — keeping stored styles both safe and usable.